TokenForge is a professional Authentication Platform built with NestJS. It implements the OIDC (OpenID Connect) standard, featuring a hybrid "Stateless Access / Stateful Refresh" architecture. It balances extreme horizontal scalability with surgical security controls like Instant Revocation and Automated Key Rotation.
Launch the Identity Infrastructure and Auth Service in one command:
# 1. Start DB & Redis
docker-compose up -d
# 2. Start Auth Service
cd backend && npm install && npm run start:devDetailed Setup: See GETTING_STARTED.md.
Visualizing active sessions, token rotation logs, and system security levels.
Distributed Identity Provider implementing the OIDC standard.
OIDC Handshake -> JWT Generation -> Stateful Refresh in Redis.
Deep Dive: See ARCHITECTURE.md for the PKI logic.
- 🛡️ OIDC Compliant: Provides
/.well-known/openid-configurationand JWKS endpoints. - 🔑 Asymmetric RS256: High-security signing where only the Auth Service holds the Private Key.
- 🔄 Token Family Rotation: Detects and stops token theft by invalidating entire lease families.
- ⚡ Redis-Backed Sessions: Sub-millisecond session revocation and L7 rate limiting.
How a user identity is forged and protected:
- Request: User submits credentials or OIDC redirect.
- Verify: Service validates against PostgreSQL via Bcrypt (Rounds=12).
- Forge: RS256 Private Key signs a stateless Access JWT (15m).
- Lease: A stateful Refresh Token is generated and pinned in Redis (7d).
- Rotate: On every refresh, the old token is burned and a new pair is issued (Rotation).
- Verify: Microservices download the Public Key via JWKS to verify tokens locally.
| Document | Description |
|---|---|
| System Architecture | RS256 PKI design, dual-token patterns, and schema. |
| Getting Started | Docker environment, OIDC config, and Test scripts. |
| Failure Scenarios | Circuit breakers, emergency revocation, and fail-secure. |
| Interview Q&A | "JWT vs Session", "RS256 vs HS256", and the Wristband Analogy. |
| Component | Technology | Role |
|---|---|---|
| Auth Engine | NestJS 10 | Modular Identity Framework. |
| Durable Store | PostgreSQL 16 | User Profiles & RBAC. |
| Fast Store | Redis 7 | Refresh Tokens & Rate Limits. |
| Cryto Logic | Passport.js | Security Strategy Abstraction. |
Harshan Aiyappa
Senior Full-Stack Hybrid AI Engineer
Voice AI • Distributed Systems • Infrastructure
This project is licensed under the MIT License - see the LICENSE file for details.